git-doc-mcp 0.1.0

package/dist/audit/logger.js

@@ -0,0 +1,179 @@
+/**
+ * Structured audit logger for security events.
+ * Writes JSON-lines to ~/.git-doc-mcp/logs/audit.jsonl with auto-rotation at 10MB.
+ *
+ * IMPORTANT: This logger runs ONLY in the main process.
+ * Worker processes use WorkerAuditProxy (defined in worker-entry.ts)
+ * which sends audit events via IPC to avoid file write race conditions.
+ *
+ * @module audit/logger
+ */
+import * as fs from 'node:fs/promises';
+import * as path from 'node:path';
+import * as os from 'node:os';
+/**
+ * Maximum audit log file size before rotation (10MB).
+ */
+const MAX_LOG_SIZE = 10 * 1024 * 1024;
+/**
+ * Buffer flush thresholds.
+ */
+const FLUSH_INTERVAL_MS = 100;
+const FLUSH_BUFFER_SIZE = 50;
+/**
+ * File-based audit logger.
+ * Writes JSON-lines to disk with buffering and auto-rotation.
+ */
+export class FileAuditLogger {
+    buffer = [];
+    flushTimer = null;
+    logDir;
+    logFile;
+    dirCreated = false;
+    flushing = false;
+    constructor(logDir) {
+        this.logDir = logDir ?? path.join(os.homedir(), '.git-doc-mcp', 'logs');
+        this.logFile = path.join(this.logDir, 'audit.jsonl');
+        this.flushTimer = setInterval(() => {
+            this.flush().catch(() => { });
+        }, FLUSH_INTERVAL_MS);
+        // Unref the timer so it doesn't prevent Node from exiting
+        if (this.flushTimer && typeof this.flushTimer.unref === 'function') {
+            this.flushTimer.unref();
+        }
+    }
+    log(event) {
+        this.buffer.push(JSON.stringify(event));
+        if (this.buffer.length >= FLUSH_BUFFER_SIZE) {
+            this.flush().catch(() => { });
+        }
+    }
+    logFetch(url, status, duration, manifestName) {
+        this.log({
+            timestamp: new Date().toISOString(),
+            event: 'fetch',
+            url,
+            status: status?.toString(),
+            duration_ms: duration,
+            manifestName,
+        });
+    }
+    logRedirect(from, to, manifestName) {
+        this.log({
+            timestamp: new Date().toISOString(),
+            event: 'redirect',
+            url: to,
+            details: { from },
+            manifestName,
+        });
+    }
+    logSecretAccess(secretName, url, allowed, manifestName) {
+        this.log({
+            timestamp: new Date().toISOString(),
+            event: 'secret-access',
+            secretName,
+            url,
+            status: allowed ? 'allowed' : 'denied',
+            manifestName,
+        });
+    }
+    logActionStart(actionName, manifestName) {
+        this.log({
+            timestamp: new Date().toISOString(),
+            event: 'action-start',
+            actionName,
+            manifestName,
+        });
+    }
+    logActionEnd(actionName, status, duration_ms, manifestName) {
+        this.log({
+            timestamp: new Date().toISOString(),
+            event: 'action-end',
+            actionName,
+            status,
+            duration_ms,
+            manifestName,
+        });
+    }
+    logActionLog(level, message, manifestName) {
+        this.log({
+            timestamp: new Date().toISOString(),
+            event: 'action-log',
+            status: level,
+            details: { message },
+            manifestName,
+        });
+    }
+    logError(message, details, manifestName) {
+        this.log({
+            timestamp: new Date().toISOString(),
+            event: 'error',
+            details: { message, ...details },
+            manifestName,
+        });
+    }
+    async close() {
+        if (this.flushTimer) {
+            clearInterval(this.flushTimer);
+            this.flushTimer = null;
+        }
+        await this.flush();
+    }
+    async flush() {
+        if (this.buffer.length === 0 || this.flushing)
+            return;
+        this.flushing = true;
+        const lines = this.buffer.splice(0);
+        try {
+            if (!this.dirCreated) {
+                await fs.mkdir(this.logDir, { recursive: true });
+                this.dirCreated = true;
+            }
+            // Check for rotation before writing
+            await this.rotate();
+            // Append all buffered lines
+            const data = lines.join('\n') + '\n';
+            await fs.appendFile(this.logFile, data, 'utf-8');
+        }
+        catch {
+            // Audit failures never crash the process
+        }
+        finally {
+            this.flushing = false;
+        }
+    }
+    async rotate() {
+        try {
+            const stat = await fs.stat(this.logFile);
+            if (stat.size >= MAX_LOG_SIZE) {
+                const timestamp = new Date().toISOString().replace(/[:.]/g, '-');
+                const rotatedFile = path.join(this.logDir, `audit-${timestamp}.jsonl`);
+                await fs.rename(this.logFile, rotatedFile);
+            }
+        }
+        catch {
+            // File doesn't exist yet or can't stat — no rotation needed
+        }
+    }
+}
+/**
+ * No-op audit logger for testing or when audit logging is disabled.
+ */
+export class NoopAuditLogger {
+    log() { }
+    logFetch() { }
+    logRedirect() { }
+    logSecretAccess() { }
+    logActionStart() { }
+    logActionEnd() { }
+    logActionLog() { }
+    logError() { }
+    async close() { }
+}
+/**
+ * Create an audit logger instance.
+ */
+export function createAuditLogger(logDir) {
+    return new FileAuditLogger(logDir);
+}
+//# sourceMappingURL=logger.js.map

package/dist/audit/logger.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"logger.js","sourceRoot":"","sources":["../../src/audit/logger.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACvC,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAgC9B;;GAEG;AACH,MAAM,YAAY,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AAEtC;;GAEG;AACH,MAAM,iBAAiB,GAAG,GAAG,CAAC;AAC9B,MAAM,iBAAiB,GAAG,EAAE,CAAC;AAE7B;;;GAGG;AACH,MAAM,OAAO,eAAe;IAClB,MAAM,GAAa,EAAE,CAAC;IACtB,UAAU,GAA0C,IAAI,CAAC;IACzD,MAAM,CAAS;IACf,OAAO,CAAS;IAChB,UAAU,GAAG,KAAK,CAAC;IACnB,QAAQ,GAAG,KAAK,CAAC;IAEzB,YAAY,MAAe;QACzB,IAAI,CAAC,MAAM,GAAG,MAAM,IAAI,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,cAAc,EAAE,MAAM,CAAC,CAAC;QACxE,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;QACrD,IAAI,CAAC,UAAU,GAAG,WAAW,CAAC,GAAG,EAAE;YACjC,IAAI,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QAC/B,CAAC,EAAE,iBAAiB,CAAC,CAAC;QACtB,0DAA0D;QAC1D,IAAI,IAAI,CAAC,UAAU,IAAI,OAAO,IAAI,CAAC,UAAU,CAAC,KAAK,KAAK,UAAU,EAAE,CAAC;YACnE,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;QAC1B,CAAC;IACH,CAAC;IAED,GAAG,CAAC,KAAiB;QACnB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;QACxC,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,iBAAiB,EAAE,CAAC;YAC5C,IAAI,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QAC/B,CAAC;IACH,CAAC;IAED,QAAQ,CAAC,GAAW,EAAE,MAAe,EAAE,QAAiB,EAAE,YAAqB;QAC7E,IAAI,CAAC,GAAG,CAAC;YACP,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,KAAK,EAAE,OAAO;YACd,GAAG;YACH,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE;YAC1B,WAAW,EAAE,QAAQ;YACrB,YAAY;SACb,CAAC,CAAC;IACL,CAAC;IAED,WAAW,CAAC,IAAY,EAAE,EAAU,EAAE,YAAqB;QACzD,IAAI,CAAC,GAAG,CAAC;YACP,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,KAAK,EAAE,UAAU;YACjB,GAAG,EAAE,EAAE;YACP,OAAO,EAAE,EAAE,IAAI,EAAE;YACjB,YAAY;SACb,CAAC,CAAC;IACL,CAAC;IAED,eAAe,CAAC,UAAkB,EAAE,GAAW,EAAE,OAAgB,EAAE,YAAqB;QACtF,IAAI,CAAC,GAAG,CAAC;YACP,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,KAAK,EAAE,eAAe;YACtB,UAAU;YACV,GAAG;YACH,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ;YACtC,YAAY;SACb,CAAC,CAAC;IACL,CAAC;IAED,cAAc,CAAC,UAAkB,EAAE,YAAqB;QACtD,IAAI,CAAC,GAAG,CAAC;YACP,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,KAAK,EAAE,cAAc;YACrB,UAAU;YACV,YAAY;SACb,CAAC,CAAC;IACL,CAAC;IAED,YAAY,CAAC,UAAkB,EAAE,MAAc,EAAE,WAAmB,EAAE,YAAqB;QACzF,IAAI,CAAC,GAAG,CAAC;YACP,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,KAAK,EAAE,YAAY;YACnB,UAAU;YACV,MAAM;YACN,WAAW;YACX,YAAY;SACb,CAAC,CAAC;IACL,CAAC;IAED,YAAY,CAAC,KAAa,EAAE,OAAe,EAAE,YAAqB;QAChE,IAAI,CAAC,GAAG,CAAC;YACP,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,KAAK,EAAE,YAAY;YACnB,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,EAAE,OAAO,EAAE;YACpB,YAAY;SACb,CAAC,CAAC;IACL,CAAC;IAED,QAAQ,CAAC,OAAe,EAAE,OAAiC,EAAE,YAAqB;QAChF,IAAI,CAAC,GAAG,CAAC;YACP,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,KAAK,EAAE,OAAO;YACd,OAAO,EAAE,EAAE,OAAO,EAAE,GAAG,OAAO,EAAE;YAChC,YAAY;SACb,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,KAAK;QACT,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACpB,aAAa,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YAC/B,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC;QACzB,CAAC;QACD,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;IACrB,CAAC;IAEO,KAAK,CAAC,KAAK;QACjB,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,QAAQ;YAAE,OAAO;QAEtD,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;QACrB,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAEpC,IAAI,CAAC;YACH,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;gBACrB,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;gBACjD,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC;YACzB,CAAC;YAED,oCAAoC;YACpC,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC;YAEpB,4BAA4B;YAC5B,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;YACrC,MAAM,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;QACnD,CAAC;QAAC,MAAM,CAAC;YACP,yCAAyC;QAC3C,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,QAAQ,GAAG,KAAK,CAAC;QACxB,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,MAAM;QAClB,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACzC,IAAI,IAAI,CAAC,IAAI,IAAI,YAAY,EAAE,CAAC;gBAC9B,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;gBACjE,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,SAAS,QAAQ,CAAC,CAAC;gBACvE,MAAM,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;YAC7C,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,4DAA4D;QAC9D,CAAC;IACH,CAAC;CACF;AAED;;GAEG;AACH,MAAM,OAAO,eAAe;IAC1B,GAAG,KAAU,CAAC;IACd,QAAQ,KAAU,CAAC;IACnB,WAAW,KAAU,CAAC;IACtB,eAAe,KAAU,CAAC;IAC1B,cAAc,KAAU,CAAC;IACzB,YAAY,KAAU,CAAC;IACvB,YAAY,KAAU,CAAC;IACvB,QAAQ,KAAU,CAAC;IACnB,KAAK,CAAC,KAAK,KAAmB,CAAC;CAChC;AAED;;GAEG;AACH,MAAM,UAAU,iBAAiB,CAAC,MAAe;IAC/C,OAAO,IAAI,eAAe,CAAC,MAAM,CAAC,CAAC;AACrC,CAAC"}

package/dist/cli/commands/serve.d.ts

@@ -0,0 +1,44 @@
+/**
+ * Serve command - starts MCP server from a manifest.
+ * @module commands/serve
+ */
+import { Manifest } from '../../index.js';
+/**
+ * Serve command options.
+ */
+export interface ServeOptions {
+    manifest: string;
+    manifestHeader: string[];
+    manifestHash?: string;
+    actionCodeHeader: string[];
+    resourceHeader: string[];
+    secret: string[];
+    timeout: string;
+    memoryLimit: string;
+    allowHttp: boolean;
+    trustChanged: boolean;
+    rateLimit: string;
+}
+/**
+ * Execute the serve command.
+ */
+export declare function serveCommand(options: ServeOptions): Promise<void>;
+/**
+ * Parse header strings into object.
+ * Format: "Header-Name: Header-Value"
+ */
+export declare function parseHeaders(headers: string[]): Record<string, string>;
+/**
+ * Parse secret strings into object.
+ * Format: "NAME=value"
+ */
+export declare function parseSecrets(secrets: string[]): Record<string, string>;
+/**
+ * Get secret scopes from manifest.
+ */
+export declare function getSecretScopes(manifest: Manifest): Record<string, string[]>;
+/**
+ * Create a safe path component from a string.
+ */
+export declare function hashPath(input: string): string;
+//# sourceMappingURL=serve.d.ts.map

package/dist/cli/commands/serve.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"serve.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/serve.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAMH,OAAO,EAQL,QAAQ,EAIT,MAAM,gBAAgB,CAAC;AAExB;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,OAAO,CAAC;IACnB,YAAY,EAAE,OAAO,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;GAEG;AACH,wBAAsB,YAAY,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CA2QvE;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAWtE;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAWtE;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAAE,QAAQ,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAO5E;AA6ED;;GAEG;AACH,wBAAgB,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAE9C"}

package/dist/cli/commands/serve.js

@@ -0,0 +1,360 @@
+/**
+ * Serve command - starts MCP server from a manifest.
+ * @module commands/serve
+ */
+import * as fs from 'node:fs/promises';
+import * as path from 'node:path';
+import * as os from 'node:os';
+import * as crypto from 'node:crypto';
+import { loadManifest, createMcpServer, startMcpServer, SecretsManager, fetchContent, verifyHash, WorkerManager, validateUrl, createAuditLogger, RateLimiter, } from '../../index.js';
+/**
+ * Execute the serve command.
+ */
+export async function serveCommand(options) {
+    const { manifest: manifestPath, manifestHeader, manifestHash: pinnedHash, actionCodeHeader, resourceHeader: resourceHeaderRaw, secret: preApprovedSecrets, timeout, memoryLimit: memoryLimitStr, allowHttp, trustChanged, } = options;
+    const memoryLimitBytes = parseInt(memoryLimitStr, 10);
+    if (!Number.isFinite(memoryLimitBytes) || memoryLimitBytes < 8 * 1024 * 1024 || memoryLimitBytes > 1024 * 1024 * 1024) {
+        console.error(`Error: --memory-limit must be an integer between 8388608 (8MB) and 1073741824 (1GB). Got: ${memoryLimitStr}`);
+        process.exit(1);
+    }
+    if (memoryLimitBytes !== 128 * 1024 * 1024) {
+        console.error(`Using custom memory limit: ${memoryLimitBytes} bytes (${(memoryLimitBytes / 1024 / 1024).toFixed(0)}MB)`);
+    }
+    // Rate limiting
+    const rateLimitValue = parseInt(options.rateLimit, 10);
+    if (!Number.isFinite(rateLimitValue) || rateLimitValue < 0) {
+        console.error(`Error: --rate-limit must be a non-negative integer. Got: ${options.rateLimit}`);
+        process.exit(1);
+    }
+    const rateLimiter = rateLimitValue > 0 ? new RateLimiter(rateLimitValue, 60_000) : null;
+    if (rateLimiter) {
+        console.error(`Rate limiting enabled: ${rateLimitValue} calls/minute`);
+    }
+    // Create audit logger (single instance for the main process)
+    const auditLogger = createAuditLogger();
+    // Parse headers
+    const manifestHeaders = parseHeaders(manifestHeader);
+    const actionHeaders = parseHeaders(actionCodeHeader);
+    const resourceHeaders = parseHeaders(resourceHeaderRaw ?? []);
+    // Parse pre-approved secrets
+    const secrets = parseSecrets(preApprovedSecrets);
+    // Load manifest
+    console.error(`Loading manifest from: ${manifestPath}`);
+    const manifestResult = await loadManifest({
+        manifestPath,
+        headers: manifestHeaders,
+        auditLogger,
+        allowHttp,
+    });
+    // Verify manifest hash if pinned
+    if (pinnedHash) {
+        if (manifestResult.hash !== pinnedHash) {
+            auditLogger.logError('Manifest hash mismatch', { expected: pinnedHash, got: manifestResult.hash });
+            console.error(`Error: Manifest hash mismatch!`);
+            console.error(`  Expected: ${pinnedHash}`);
+            console.error(`  Got: ${manifestResult.hash}`);
+            process.exit(1);
+        }
+    }
+    else {
+        // TOFU: Check if manifest hash changed
+        await checkTofu(manifestPath, manifestResult.hash, trustChanged);
+    }
+    const { manifest } = manifestResult;
+    // Setup secrets manager
+    const secretsManager = new SecretsManager();
+    // Approve pre-approved secrets from --secret flags
+    for (const [name, value] of Object.entries(secrets)) {
+        const secretDef = manifest.secrets?.find((s) => s.name === name);
+        if (secretDef) {
+            secretsManager.approve(secretDef, value);
+            console.error(`Approved secret: ${name}`);
+        }
+    }
+    // Check environment variables for missing secrets (AC6)
+    // --secret flag takes precedence over env vars
+    for (const secret of manifest.secrets ?? []) {
+        if (!secretsManager.isApproved(secret.name)) {
+            const envName = 'GIT_MCP_SECRET_' + secret.name.toUpperCase().replace(/-/g, '_');
+            const envValue = process.env[envName];
+            if (envValue !== undefined) {
+                secretsManager.approve(secret, envValue);
+                console.error(`Approved secret from env: ${secret.name} (${envName})`);
+            }
+        }
+    }
+    // Prompt for missing required secrets
+    for (const secret of manifest.secrets ?? []) {
+        if (secret.required && !secretsManager.isApproved(secret.name)) {
+            console.error(`Error: Required secret "${secret.name}" not provided`);
+            process.exit(1);
+        }
+    }
+    // Create worker manager with audit logger
+    const workerManager = new WorkerManager({
+        timeout: parseInt(timeout, 10),
+        logger: console.error,
+        auditLogger,
+    });
+    // Action cache
+    const actionCache = new Map();
+    // Create MCP server
+    const server = createMcpServer({
+        manifest,
+        onToolCall: async (name, input) => {
+            // Rate limit check
+            if (rateLimiter && !rateLimiter.tryAcquire()) {
+                auditLogger.logError('Rate limit exceeded', { toolName: name, limit: rateLimitValue }, manifest.name);
+                return {
+                    content: [{
+                            type: 'text',
+                            text: `Rate limit exceeded: ${rateLimitValue} calls per minute. Retry after a brief pause or increase with --rate-limit <n>.`,
+                        }],
+                    isError: true,
+                };
+            }
+            const tool = manifest.tools?.find((t) => t.name === name);
+            if (!tool) {
+                auditLogger.logError('Tool not found', { toolName: name }, manifest.name);
+                return {
+                    content: [{ type: 'text', text: `Tool not found: ${name}` }],
+                    isError: true,
+                };
+            }
+            try {
+                // Log action start
+                auditLogger.logActionStart(name, manifest.name);
+                const startTime = Date.now();
+                // Get or fetch action code
+                let actionCode = actionCache.get(tool.action);
+                if (!actionCode) {
+                    console.error(`Fetching action: ${tool.action}`);
+                    const result = await fetchContent(tool.action, {
+                        headers: actionHeaders,
+                        auditLogger,
+                        allowHttp,
+                    });
+                    // Verify hash
+                    verifyHash(result.content, tool.actionHash);
+                    actionCode = result.content;
+                    actionCache.set(tool.action, actionCode);
+                }
+                // Execute in worker
+                const response = await workerManager.executeAction({
+                    id: crypto.randomUUID(),
+                    type: 'execute',
+                    payload: {
+                        actionUrl: tool.action,
+                        actionCode,
+                        input,
+                        secrets: secretsManager.getAllSecrets(),
+                        timeout: parseInt(timeout, 10),
+                        manifest: {
+                            name: manifest.name,
+                            version: manifest.version,
+                        },
+                        secretScopes: getSecretScopes(manifest),
+                        memoryLimit: memoryLimitBytes,
+                    },
+                });
+                if (response.type === 'error') {
+                    auditLogger.logActionEnd(name, 'error', Date.now() - startTime, manifest.name);
+                    auditLogger.logError('Worker execution failed', { toolName: name, error: response.error?.message }, manifest.name);
+                    return {
+                        content: [{ type: 'text', text: response.error?.message ?? 'Unknown error' }],
+                        isError: true,
+                    };
+                }
+                auditLogger.logActionEnd(name, 'success', Date.now() - startTime, manifest.name);
+                return response.result;
+            }
+            catch (error) {
+                const message = error instanceof Error ? error.message : String(error);
+                auditLogger.logError('Action execution failed', { toolName: name, error: message }, manifest.name);
+                return {
+                    content: [{ type: 'text', text: `Error: ${message}` }],
+                    isError: true,
+                };
+            }
+        },
+        onResourceRead: manifest.resources ? async (uri) => {
+            const resource = manifest.resources?.find((r) => r.uri === uri);
+            if (!resource) {
+                throw new Error(`Resource not found: ${uri}`);
+            }
+            try {
+                // Validate resource URI against SSRF (AC19)
+                const resourceSchemes = allowHttp ? ['https', 'http'] : ['https'];
+                await validateUrl(resource.uri, { allowedSchemes: resourceSchemes });
+                const response = await fetchContent(resource.uri, {
+                    headers: resourceHeaders,
+                    auditLogger,
+                    allowHttp,
+                });
+                return response.content;
+            }
+            catch (error) {
+                const message = error instanceof Error ? error.message : String(error);
+                throw new Error(`Failed to read resource: ${message}`);
+            }
+        } : undefined,
+        onPromptGet: manifest.prompts ? async (name, args) => {
+            const prompt = manifest.prompts?.find((p) => p.name === name);
+            if (!prompt) {
+                throw new Error(`Prompt not found: ${name}`);
+            }
+            // Structured messages: substitute {{arg}} placeholders and return
+            if (prompt.messages) {
+                return {
+                    description: prompt.description,
+                    messages: prompt.messages.map((msg) => ({
+                        role: msg.role,
+                        content: substituteContent(msg.content, args ?? {}),
+                    })),
+                };
+            }
+            // Simple fallback: build single user message from description + args
+            let text = prompt.description;
+            if (prompt.args && args) {
+                text += '\n\nArguments:\n';
+                for (const arg of prompt.args) {
+                    const value = args[arg.name];
+                    if (value !== undefined) {
+                        text += `- ${arg.name}: ${value}\n`;
+                    }
+                }
+            }
+            return {
+                description: prompt.description,
+                messages: [{ role: 'user', content: { type: 'text', text } }],
+            };
+        } : undefined,
+    });
+    // Cleanup on exit
+    const cleanup = async () => {
+        await auditLogger.close();
+    };
+    process.on('beforeExit', cleanup);
+    // Start server
+    console.error(`Starting MCP server: ${manifest.name} v${manifest.version}`);
+    await startMcpServer(server);
+}
+/**
+ * Parse header strings into object.
+ * Format: "Header-Name: Header-Value"
+ */
+export function parseHeaders(headers) {
+    const result = {};
+    for (const header of headers) {
+        const colonIndex = header.indexOf(':');
+        if (colonIndex > 0) {
+            const name = header.slice(0, colonIndex).trim();
+            const value = header.slice(colonIndex + 1).trim();
+            result[name] = value;
+        }
+    }
+    return result;
+}
+/**
+ * Parse secret strings into object.
+ * Format: "NAME=value"
+ */
+export function parseSecrets(secrets) {
+    const result = {};
+    for (const secret of secrets) {
+        const equalIndex = secret.indexOf('=');
+        if (equalIndex > 0) {
+            const name = secret.slice(0, equalIndex).trim();
+            const value = secret.slice(equalIndex + 1);
+            result[name] = value;
+        }
+    }
+    return result;
+}
+/**
+ * Get secret scopes from manifest.
+ */
+export function getSecretScopes(manifest) {
+    const result = {};
+    for (const secret of manifest.secrets ?? []) {
+        const scopes = Array.isArray(secret.scope) ? secret.scope : [secret.scope];
+        result[secret.name] = scopes;
+    }
+    return result;
+}
+/**
+ * Substitute {{argName}} placeholders in a template string.
+ */
+function substituteTemplate(template, args) {
+    return template.replace(/\{\{(\w+)\}\}/g, (_match, name) => args[name] ?? `{{${name}}}`);
+}
+/**
+ * Substitute {{argName}} placeholders in prompt content.
+ * Ensures resource.text is always present (required by MCP TextResourceContents).
+ */
+function substituteContent(content, args) {
+    if (content.type === 'text') {
+        return { type: 'text', text: substituteTemplate(content.text, args) };
+    }
+    const resource = {
+        uri: substituteTemplate(content.resource.uri, args),
+        text: substituteTemplate(content.resource.text ?? '', args),
+    };
+    if (content.resource.mimeType) {
+        resource.mimeType = content.resource.mimeType;
+    }
+    return { type: 'resource', resource };
+}
+/**
+ * Check TOFU (Trust-on-First-Use) for manifest hash.
+ */
+async function checkTofu(manifestPath, currentHash, trustChanged = false) {
+    const trustDir = path.join(os.homedir(), '.git-doc-mcp', 'trust');
+    const trustFile = path.join(trustDir, hashPath(manifestPath), 'manifest.trust');
+    try {
+        const storedHash = await fs.readFile(trustFile, 'utf-8');
+        if (storedHash !== currentHash) {
+            console.error(``);
+            console.error(`Warning: Manifest content has changed since last use!`);
+            console.error(`  Previous: ${storedHash}`);
+            console.error(`  Current:  ${currentHash}`);
+            console.error(``);
+            console.error(`This could indicate:`);
+            console.error(`  - Legitimate update from the manifest author`);
+            console.error(`  - Manifest compromise`);
+            console.error(``);
+            if (trustChanged) {
+                await fs.writeFile(trustFile, currentHash, 'utf-8');
+                console.error(`Manifest change accepted. Updated stored hash.`);
+            }
+            else {
+                console.error(`Current hash: ${currentHash}`);
+                console.error(`To accept this change, re-run with: --trust-changed`);
+                console.error(`For CI pinning, use: --manifest-hash ${currentHash}`);
+                process.exit(1);
+            }
+        }
+    }
+    catch (error) {
+        const code = error.code;
+        if (code === 'ENOENT') {
+            // First use - trust file doesn't exist yet
+            await fs.mkdir(path.dirname(trustFile), { recursive: true });
+            await fs.writeFile(trustFile, currentHash, 'utf-8');
+            console.error(`First use of manifest. Stored hash: ${currentHash}`);
+            console.error(`For CI pinning, use: --manifest-hash ${currentHash}`);
+        }
+        else {
+            // Unexpected error reading trust file - fail closed
+            console.error(`Error reading trust file: ${error.message}`);
+            process.exit(1);
+        }
+    }
+}
+/**
+ * Create a safe path component from a string.
+ */
+export function hashPath(input) {
+    return crypto.createHash('sha256').update(input).digest('hex').slice(0, 16);
+}
+//# sourceMappingURL=serve.js.map

package/dist/cli/commands/serve.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"serve.js","sourceRoot":"","sources":["../../../src/cli/commands/serve.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACvC,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,MAAM,MAAM,aAAa,CAAC;AACtC,OAAO,EACL,YAAY,EACZ,eAAe,EACf,cAAc,EACd,cAAc,EACd,YAAY,EACZ,UAAU,EACV,aAAa,EAEb,WAAW,EACX,iBAAiB,EACjB,WAAW,GACZ,MAAM,gBAAgB,CAAC;AAmBxB;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,OAAqB;IACtD,MAAM,EACJ,QAAQ,EAAE,YAAY,EACtB,cAAc,EACd,YAAY,EAAE,UAAU,EACxB,gBAAgB,EAChB,cAAc,EAAE,iBAAiB,EACjC,MAAM,EAAE,kBAAkB,EAC1B,OAAO,EACP,WAAW,EAAE,cAAc,EAC3B,SAAS,EACT,YAAY,GACb,GAAG,OAAO,CAAC;IAEZ,MAAM,gBAAgB,GAAG,QAAQ,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC;IACtD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,gBAAgB,CAAC,IAAI,gBAAgB,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,IAAI,gBAAgB,GAAG,IAAI,GAAG,IAAI,GAAG,IAAI,EAAE,CAAC;QACtH,OAAO,CAAC,KAAK,CAAC,6FAA6F,cAAc,EAAE,CAAC,CAAC;QAC7H,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,IAAI,gBAAgB,KAAK,GAAG,GAAG,IAAI,GAAG,IAAI,EAAE,CAAC;QAC3C,OAAO,CAAC,KAAK,CAAC,8BAA8B,gBAAgB,WAAW,CAAC,gBAAgB,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IAC3H,CAAC;IAED,gBAAgB;IAChB,MAAM,cAAc,GAAG,QAAQ,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;IACvD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,IAAI,cAAc,GAAG,CAAC,EAAE,CAAC;QAC3D,OAAO,CAAC,KAAK,CAAC,4DAA4D,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC;QAC/F,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,MAAM,WAAW,GAAG,cAAc,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,WAAW,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACxF,IAAI,WAAW,EAAE,CAAC;QAChB,OAAO,CAAC,KAAK,CAAC,0BAA0B,cAAc,eAAe,CAAC,CAAC;IACzE,CAAC;IAED,6DAA6D;IAC7D,MAAM,WAAW,GAAG,iBAAiB,EAAE,CAAC;IAExC,gBAAgB;IAChB,MAAM,eAAe,GAAG,YAAY,CAAC,cAAc,CAAC,CAAC;IACrD,MAAM,aAAa,GAAG,YAAY,CAAC,gBAAgB,CAAC,CAAC;IACrD,MAAM,eAAe,GAAG,YAAY,CAAC,iBAAiB,IAAI,EAAE,CAAC,CAAC;IAE9D,6BAA6B;IAC7B,MAAM,OAAO,GAAG,YAAY,CAAC,kBAAkB,CAAC,CAAC;IAEjD,gBAAgB;IAChB,OAAO,CAAC,KAAK,CAAC,0BAA0B,YAAY,EAAE,CAAC,CAAC;IACxD,MAAM,cAAc,GAAG,MAAM,YAAY,CAAC;QACxC,YAAY;QACZ,OAAO,EAAE,eAAe;QACxB,WAAW;QACX,SAAS;KACV,CAAC,CAAC;IAEH,iCAAiC;IACjC,IAAI,UAAU,EAAE,CAAC;QACf,IAAI,cAAc,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;YACvC,WAAW,CAAC,QAAQ,CAAC,wBAAwB,EAAE,EAAE,QAAQ,EAAE,UAAU,EAAE,GAAG,EAAE,cAAc,CAAC,IAAI,EAAE,CAAC,CAAC;YACnG,OAAO,CAAC,KAAK,CAAC,gCAAgC,CAAC,CAAC;YAChD,OAAO,CAAC,KAAK,CAAC,eAAe,UAAU,EAAE,CAAC,CAAC;YAC3C,OAAO,CAAC,KAAK,CAAC,UAAU,cAAc,CAAC,IAAI,EAAE,CAAC,CAAC;YAC/C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC;SAAM,CAAC;QACN,uCAAuC;QACvC,MAAM,SAAS,CAAC,YAAY,EAAE,cAAc,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;IACnE,CAAC;IAED,MAAM,EAAE,QAAQ,EAAE,GAAG,cAAc,CAAC;IAEpC,wBAAwB;IACxB,MAAM,cAAc,GAAG,IAAI,cAAc,EAAE,CAAC;IAE5C,mDAAmD;IACnD,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACpD,MAAM,SAAS,GAAG,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;QACjE,IAAI,SAAS,EAAE,CAAC;YACd,cAAc,CAAC,OAAO,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;YACzC,OAAO,CAAC,KAAK,CAAC,oBAAoB,IAAI,EAAE,CAAC,CAAC;QAC5C,CAAC;IACH,CAAC;IAED,wDAAwD;IACxD,+CAA+C;IAC/C,KAAK,MAAM,MAAM,IAAI,QAAQ,CAAC,OAAO,IAAI,EAAE,EAAE,CAAC;QAC5C,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;YAC5C,MAAM,OAAO,GAAG,iBAAiB,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;YACjF,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YACtC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;gBAC3B,cAAc,CAAC,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;gBACzC,OAAO,CAAC,KAAK,CAAC,6BAA6B,MAAM,CAAC,IAAI,KAAK,OAAO,GAAG,CAAC,CAAC;YACzE,CAAC;QACH,CAAC;IACH,CAAC;IAED,sCAAsC;IACtC,KAAK,MAAM,MAAM,IAAI,QAAQ,CAAC,OAAO,IAAI,EAAE,EAAE,CAAC;QAC5C,IAAI,MAAM,CAAC,QAAQ,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;YAC/D,OAAO,CAAC,KAAK,CAAC,2BAA2B,MAAM,CAAC,IAAI,gBAAgB,CAAC,CAAC;YACtE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC;IAED,0CAA0C;IAC1C,MAAM,aAAa,GAAG,IAAI,aAAa,CAAC;QACtC,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,EAAE,CAAC;QAC9B,MAAM,EAAE,OAAO,CAAC,KAAK;QACrB,WAAW;KACZ,CAAC,CAAC;IAEH,eAAe;IACf,MAAM,WAAW,GAAG,IAAI,GAAG,EAAkB,CAAC;IAE9C,oBAAoB;IACpB,MAAM,MAAM,GAAG,eAAe,CAAC;QAC7B,QAAQ;QACR,UAAU,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE;YAChC,mBAAmB;YACnB,IAAI,WAAW,IAAI,CAAC,WAAW,CAAC,UAAU,EAAE,EAAE,CAAC;gBAC7C,WAAW,CAAC,QAAQ,CAAC,qBAAqB,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC;gBACtG,OAAO;oBACL,OAAO,EAAE,CAAC;4BACR,IAAI,EAAE,MAAM;4BACZ,IAAI,EAAE,wBAAwB,cAAc,iFAAiF;yBAC9H,CAAC;oBACF,OAAO,EAAE,IAAI;iBACd,CAAC;YACJ,CAAC;YAED,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;YAC1D,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,WAAW,CAAC,QAAQ,CAAC,gBAAgB,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC;gBAC1E,OAAO;oBACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,IAAI,EAAE,EAAE,CAAC;oBAC5D,OAAO,EAAE,IAAI;iBACd,CAAC;YACJ,CAAC;YAED,IAAI,CAAC;gBACH,mBAAmB;gBACnB,WAAW,CAAC,cAAc,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC;gBAChD,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;gBAE7B,2BAA2B;gBAC3B,IAAI,UAAU,GAAG,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBAC9C,IAAI,CAAC,UAAU,EAAE,CAAC;oBAChB,OAAO,CAAC,KAAK,CAAC,oBAAoB,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;oBACjD,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,MAAM,EAAE;wBAC7C,OAAO,EAAE,aAAa;wBACtB,WAAW;wBACX,SAAS;qBACV,CAAC,CAAC;oBAEH,cAAc;oBACd,UAAU,CAAC,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;oBAE5C,UAAU,GAAG,MAAM,CAAC,OAAO,CAAC;oBAC5B,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;gBAC3C,CAAC;gBAED,oBAAoB;gBACpB,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,aAAa,CAAC;oBACjD,EAAE,EAAE,MAAM,CAAC,UAAU,EAAE;oBACvB,IAAI,EAAE,SAAS;oBACf,OAAO,EAAE;wBACP,SAAS,EAAE,IAAI,CAAC,MAAM;wBACtB,UAAU;wBACV,KAAK;wBACL,OAAO,EAAE,cAAc,CAAC,aAAa,EAAE;wBACvC,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,EAAE,CAAC;wBAC9B,QAAQ,EAAE;4BACR,IAAI,EAAE,QAAQ,CAAC,IAAI;4BACnB,OAAO,EAAE,QAAQ,CAAC,OAAO;yBAC1B;wBACD,YAAY,EAAE,eAAe,CAAC,QAAQ,CAAC;wBACvC,WAAW,EAAE,gBAAgB;qBAC9B;iBACF,CAAC,CAAC;gBAEH,IAAI,QAAQ,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;oBAC9B,WAAW,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC;oBAC/E,WAAW,CAAC,QAAQ,CAAC,yBAAyB,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC;oBACnH,OAAO;wBACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,CAAC,KAAK,EAAE,OAAO,IAAI,eAAe,EAAE,CAAC;wBAC7E,OAAO,EAAE,IAAI;qBACd,CAAC;gBACJ,CAAC;gBAED,WAAW,CAAC,YAAY,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC;gBACjF,OAAO,QAAQ,CAAC,MAAM,CAAC;YACzB,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBACvE,WAAW,CAAC,QAAQ,CAAC,yBAAyB,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC;gBACnG,OAAO;oBACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,OAAO,EAAE,EAAE,CAAC;oBACtD,OAAO,EAAE,IAAI;iBACd,CAAC;YACJ,CAAC;QACH,CAAC;QACD,cAAc,EAAE,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;YACjD,MAAM,QAAQ,GAAG,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC;YAChE,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,MAAM,IAAI,KAAK,CAAC,uBAAuB,GAAG,EAAE,CAAC,CAAC;YAChD,CAAC;YAED,IAAI,CAAC;gBACH,4CAA4C;gBAC5C,MAAM,eAAe,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;gBAClE,MAAM,WAAW,CAAC,QAAQ,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,eAAe,EAAE,CAAC,CAAC;gBAErE,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,QAAQ,CAAC,GAAG,EAAE;oBAChD,OAAO,EAAE,eAAe;oBACxB,WAAW;oBACX,SAAS;iBACV,CAAC,CAAC;gBAEH,OAAO,QAAQ,CAAC,OAAO,CAAC;YAC1B,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBACvE,MAAM,IAAI,KAAK,CAAC,4BAA4B,OAAO,EAAE,CAAC,CAAC;YACzD,CAAC;QACH,CAAC,CAAC,CAAC,CAAC,SAAS;QACb,WAAW,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE;YACnD,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;YAC9D,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,IAAI,KAAK,CAAC,qBAAqB,IAAI,EAAE,CAAC,CAAC;YAC/C,CAAC;YAED,kEAAkE;YAClE,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;gBACpB,OAAO;oBACL,WAAW,EAAE,MAAM,CAAC,WAAW;oBAC/B,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;wBACtC,IAAI,EAAE,GAAG,CAAC,IAAI;wBACd,OAAO,EAAE,iBAAiB,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,IAAI,EAAE,CAAC;qBACpD,CAAC,CAAC;iBACJ,CAAC;YACJ,CAAC;YAED,qEAAqE;YACrE,IAAI,IAAI,GAAG,MAAM,CAAC,WAAW,CAAC;YAC9B,IAAI,MAAM,CAAC,IAAI,IAAI,IAAI,EAAE,CAAC;gBACxB,IAAI,IAAI,kBAAkB,CAAC;gBAC3B,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;oBAC9B,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;oBAC7B,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;wBACxB,IAAI,IAAI,KAAK,GAAG,CAAC,IAAI,KAAK,KAAK,IAAI,CAAC;oBACtC,CAAC;gBACH,CAAC;YACH,CAAC;YAED,OAAO;gBACL,WAAW,EAAE,MAAM,CAAC,WAAW;gBAC/B,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,EAAE,CAAC;aAChF,CAAC;QACJ,CAAC,CAAC,CAAC,CAAC,SAAS;KACd,CAAC,CAAC;IAEH,kBAAkB;IAClB,MAAM,OAAO,GAAG,KAAK,IAAI,EAAE;QACzB,MAAM,WAAW,CAAC,KAAK,EAAE,CAAC;IAC5B,CAAC,CAAC;IACF,OAAO,CAAC,EAAE,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;IAElC,eAAe;IACf,OAAO,CAAC,KAAK,CAAC,wBAAwB,QAAQ,CAAC,IAAI,KAAK,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC;IAC5E,MAAM,cAAc,CAAC,MAAM,CAAC,CAAC;AAC/B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,OAAiB;IAC5C,MAAM,MAAM,GAA2B,EAAE,CAAC;IAC1C,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,MAAM,UAAU,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACvC,IAAI,UAAU,GAAG,CAAC,EAAE,CAAC;YACnB,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC,IAAI,EAAE,CAAC;YAChD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YAClD,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;QACvB,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,OAAiB;IAC5C,MAAM,MAAM,GAA2B,EAAE,CAAC;IAC1C,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,MAAM,UAAU,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACvC,IAAI,UAAU,GAAG,CAAC,EAAE,CAAC;YACnB,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC,IAAI,EAAE,CAAC;YAChD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC;YAC3C,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;QACvB,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,eAAe,CAAC,QAAkB;IAChD,MAAM,MAAM,GAA6B,EAAE,CAAC;IAC5C,KAAK,MAAM,MAAM,IAAI,QAAQ,CAAC,OAAO,IAAI,EAAE,EAAE,CAAC;QAC5C,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC3E,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC;IAC/B,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;GAEG;AACH,SAAS,kBAAkB,CAAC,QAAgB,EAAE,IAA4B;IACxE,OAAO,QAAQ,CAAC,OAAO,CAAC,gBAAgB,EAAE,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,IAAI,IAAI,CAAC,CAAC;AAC3F,CAAC;AAED;;;GAGG;AACH,SAAS,iBAAiB,CACxB,OAA2H,EAC3H,IAA4B;IAE5B,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QAC5B,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,kBAAkB,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC;IACxE,CAAC;IACD,MAAM,QAAQ,GAAqD;QACjE,GAAG,EAAE,kBAAkB,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC;QACnD,IAAI,EAAE,kBAAkB,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,IAAI,EAAE,EAAE,IAAI,CAAC;KAC5D,CAAC;IACF,IAAI,OAAO,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC;QAC9B,QAAQ,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC;IAChD,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC;AACxC,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,SAAS,CAAC,YAAoB,EAAE,WAAmB,EAAE,YAAY,GAAG,KAAK;IACtF,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,cAAc,EAAE,OAAO,CAAC,CAAC;IAClE,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,YAAY,CAAC,EAAE,gBAAgB,CAAC,CAAC;IAEhF,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QAEzD,IAAI,UAAU,KAAK,WAAW,EAAE,CAAC;YAC/B,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YAClB,OAAO,CAAC,KAAK,CAAC,uDAAuD,CAAC,CAAC;YACvE,OAAO,CAAC,KAAK,CAAC,eAAe,UAAU,EAAE,CAAC,CAAC;YAC3C,OAAO,CAAC,KAAK,CAAC,eAAe,WAAW,EAAE,CAAC,CAAC;YAC5C,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YAClB,OAAO,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAC;YACtC,OAAO,CAAC,KAAK,CAAC,gDAAgD,CAAC,CAAC;YAChE,OAAO,CAAC,KAAK,CAAC,yBAAyB,CAAC,CAAC;YACzC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YAElB,IAAI,YAAY,EAAE,CAAC;gBACjB,MAAM,EAAE,CAAC,SAAS,CAAC,SAAS,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC;gBACpD,OAAO,CAAC,KAAK,CAAC,gDAAgD,CAAC,CAAC;YAClE,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,KAAK,CAAC,iBAAiB,WAAW,EAAE,CAAC,CAAC;gBAC9C,OAAO,CAAC,KAAK,CAAC,qDAAqD,CAAC,CAAC;gBACrE,OAAO,CAAC,KAAK,CAAC,wCAAwC,WAAW,EAAE,CAAC,CAAC;gBACrE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;QACH,CAAC;IACH,CAAC;IAAC,OAAO,KAAc,EAAE,CAAC;QACxB,MAAM,IAAI,GAAI,KAA+B,CAAC,IAAI,CAAC;QACnD,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;YACtB,2CAA2C;YAC3C,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAC7D,MAAM,EAAE,CAAC,SAAS,CAAC,SAAS,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC;YACpD,OAAO,CAAC,KAAK,CAAC,uCAAuC,WAAW,EAAE,CAAC,CAAC;YACpE,OAAO,CAAC,KAAK,CAAC,wCAAwC,WAAW,EAAE,CAAC,CAAC;QACvE,CAAC;aAAM,CAAC;YACN,oDAAoD;YACpD,OAAO,CAAC,KAAK,CAAC,6BAA8B,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC;YACvE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,QAAQ,CAAC,KAAa;IACpC,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAC9E,CAAC"}

package/dist/cli/index.d.ts

@@ -0,0 +1,21 @@
+#!/usr/bin/env node
+/**
+ * git-doc-mcp CLI entry point.
+ *
+ * Usage:
+ *   npx git-doc-mcp --manifest <url-or-path> [options]
+ *   npx git-doc-mcp serve --manifest <url-or-path> [options]
+ *
+ * Options:
+ *   --manifest <path>          URL or local path to manifest.yml
+ *   --manifest-header <header> Header for fetching manifest (can be repeated)
+ *   --manifest-hash <hash>     Expected manifest hash (for pinning)
+ *   --action-code-header <h>   Header for downloading action scripts
+ *   --secret <name=value>      Pre-approved secret (can be repeated)
+ *   --help                     Show help
+ *   --version                  Show version
+ */
+import { Command } from 'commander';
+declare const program: Command;
+export { program };
+//# sourceMappingURL=index.d.ts.map

package/dist/cli/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/cli/index.ts"],"names":[],"mappings":";AACA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAGpC,QAAA,MAAM,OAAO,SAAgB,CAAC;AAwD9B,OAAO,EAAE,OAAO,EAAE,CAAC"}